15 days ago
Hi besties,
My website is currently service stale TLS certificates causing a terrible unhappiness to myself.
Verified via:
curl https://api.pxseu.com -vvvv --resolve api.pxseu.com:443:69.46.46.46
openssl s_client -connect 69.46.46.46:443 \
-servername api.pxseu.com \
-verify_hostname api.pxseu.com \
-showcerts -state -msg </dev/null
Thanks,
pxseu
Pinned Solution
15 days ago
Have you tried re-adding the domain? It usually fixes it. If a certificate isn't issued within a day, I suggest you delete the domain along with its related DNS records, wait ~10-15 minutes, and add it again.
5 Replies
15 days ago
The CNAME record for api.pxseu.com is not pointing to Railway, which is why the certificate cannot complete issuance. In your Cloudflare DNS, add a CNAME record for api.pxseu.com targeting qcd599cg.up.railway.app, and if you have Cloudflare's proxy enabled (orange cloud), try setting it to DNS-only (grey cloud) first so Railway can issue and serve the certificate directly.
Status changed to Awaiting User Response Railway • 15 days ago
15 days ago
For the record, this was already working and defined so that should not be an issue at all, regardless I did that.
Attachments
Status changed to Awaiting Railway Response Railway • 15 days ago
15 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 15 days ago
15 days ago
Have you tried re-adding the domain? It usually fixes it. If a certificate isn't issued within a day, I suggest you delete the domain along with its related DNS records, wait ~10-15 minutes, and add it again.
darseen
Have you tried re-adding the domain? It usually fixes it. If a certificate isn't issued within a day, I suggest you delete the domain along with its related DNS records, wait ~10-15 minutes, and add it again.
15 days ago
This is a good temporary work around so I'll accept it as is -- however I do imagine the pure fact I have to do this is really upsetting that I even have to touch this issue (that I was not notified until my personal alerting did) and many people also experienced this (seeing other threads.)
The certificate has 90 days of life and there should've been made at least a few attempts so not getting notified about my service being unreachable is silly.
pxseu
This is a good temporary work around so I'll accept it as is -- however I do imagine the pure fact I have to do this is really upsetting that I even have to touch this issue (that I was not notified until my personal alerting did) and many people also experienced this (seeing other threads.) The certificate has 90 days of life and there should've been made at least a few attempts so not getting notified about my service being unreachable is silly.
15 days ago
Not sure if you already have this set up, but you can set up a monitoring service as a way to get notified about such incidents in the future, if they ever occur. One option that comes to mind is Uptime Kuma, which has native support for checking SSL certificate validity and expiration dates. There is a template for it, so it's easy to spin up: https://railway.com/deploy/p6dsil
Status changed to Solved 0x5b62656e5d • 10 days ago